From 74d76b87bcbf715734abaa25acd98056f8e04f5c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 30 Mar 2019 11:02:03 +0100 Subject: [PATCH] 5.0-stable patches added patches: alsa-hda-realtek-add-support-for-acer-aspire-e5-523g-es1-432-headset-mic.patch alsa-hda-realtek-add-support-headset-mode-for-dell-wyse-aio.patch alsa-hda-realtek-add-support-headset-mode-for-new-dell-wyse-nb.patch alsa-hda-realtek-enable-asus-x441mb-and-x705fd-headset-mic-with-alc256.patch alsa-hda-realtek-enable-headset-mic-of-acer-aio-with-alc286.patch alsa-hda-realtek-enable-headset-mic-of-acer-aspire-z24-890-with-alc286.patch alsa-hda-realtek-enable-headset-mic-of-asus-p5440ff-with-alc256.patch alsa-hda-realtek-enable-headset-mic-of-asus-x430un-and-x512dk-with-alc256.patch alsa-hda-realtek-fix-speakers-on-acer-predator-helios-500-ryzen-laptops.patch alsa-hda-realtek-fixed-headset-mic-jd-not-stable.patch alsa-hda-realtek-merge-alc_fixup_headset_jack-to-alc295_fixup_chromebook.patch alsa-pcm-don-t-suspend-stream-in-unrecoverable-pcm-state.patch alsa-pcm-fix-possible-oob-access-in-pcm-oss-plugins.patch alsa-rawmidi-fix-potential-spectre-v1-vulnerability.patch alsa-seq-oss-fix-spectre-v1-vulnerability.patch --- ...r-aspire-e5-523g-es1-432-headset-mic.patch | 35 ++++++ ...pport-headset-mode-for-dell-wyse-aio.patch | 68 +++++++++++ ...rt-headset-mode-for-new-dell-wyse-nb.patch | 29 +++++ ...b-and-x705fd-headset-mic-with-alc256.patch | 60 ++++++++++ ...-headset-mic-of-acer-aio-with-alc286.patch | 65 ++++++++++ ...c-of-acer-aspire-z24-890-with-alc286.patch | 32 +++++ ...dset-mic-of-asus-p5440ff-with-alc256.patch | 36 ++++++ ...f-asus-x430un-and-x512dk-with-alc256.patch | 35 ++++++ ...er-predator-helios-500-ryzen-laptops.patch | 68 +++++++++++ ...ltek-fixed-headset-mic-jd-not-stable.patch | 80 +++++++++++++ ...dset_jack-to-alc295_fixup_chromebook.patch | 111 ++++++++++++++++++ ...nd-stream-in-unrecoverable-pcm-state.patch | 70 +++++++++++ ...ssible-oob-access-in-pcm-oss-plugins.patch | 104 ++++++++++++++++ ...x-potential-spectre-v1-vulnerability.patch | 52 ++++++++ ...seq-oss-fix-spectre-v1-vulnerability.patch | 53 +++++++++ queue-5.0/series | 15 +++ 16 files changed, 913 insertions(+) create mode 100644 queue-5.0/alsa-hda-realtek-add-support-for-acer-aspire-e5-523g-es1-432-headset-mic.patch create mode 100644 queue-5.0/alsa-hda-realtek-add-support-headset-mode-for-dell-wyse-aio.patch create mode 100644 queue-5.0/alsa-hda-realtek-add-support-headset-mode-for-new-dell-wyse-nb.patch create mode 100644 queue-5.0/alsa-hda-realtek-enable-asus-x441mb-and-x705fd-headset-mic-with-alc256.patch create mode 100644 queue-5.0/alsa-hda-realtek-enable-headset-mic-of-acer-aio-with-alc286.patch create mode 100644 queue-5.0/alsa-hda-realtek-enable-headset-mic-of-acer-aspire-z24-890-with-alc286.patch create mode 100644 queue-5.0/alsa-hda-realtek-enable-headset-mic-of-asus-p5440ff-with-alc256.patch create mode 100644 queue-5.0/alsa-hda-realtek-enable-headset-mic-of-asus-x430un-and-x512dk-with-alc256.patch create mode 100644 queue-5.0/alsa-hda-realtek-fix-speakers-on-acer-predator-helios-500-ryzen-laptops.patch create mode 100644 queue-5.0/alsa-hda-realtek-fixed-headset-mic-jd-not-stable.patch create mode 100644 queue-5.0/alsa-hda-realtek-merge-alc_fixup_headset_jack-to-alc295_fixup_chromebook.patch create mode 100644 queue-5.0/alsa-pcm-don-t-suspend-stream-in-unrecoverable-pcm-state.patch create mode 100644 queue-5.0/alsa-pcm-fix-possible-oob-access-in-pcm-oss-plugins.patch create mode 100644 queue-5.0/alsa-rawmidi-fix-potential-spectre-v1-vulnerability.patch create mode 100644 queue-5.0/alsa-seq-oss-fix-spectre-v1-vulnerability.patch diff --git a/queue-5.0/alsa-hda-realtek-add-support-for-acer-aspire-e5-523g-es1-432-headset-mic.patch b/queue-5.0/alsa-hda-realtek-add-support-for-acer-aspire-e5-523g-es1-432-headset-mic.patch new file mode 100644 index 00000000000..ec7f0a85639 --- /dev/null +++ b/queue-5.0/alsa-hda-realtek-add-support-for-acer-aspire-e5-523g-es1-432-headset-mic.patch @@ -0,0 +1,35 @@ +From c7531e31c8a440b5fe6bd62664def5bcb6262f96 Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Thu, 21 Mar 2019 17:17:31 +0800 +Subject: ALSA: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset mic + +From: Chris Chiu + +commit c7531e31c8a440b5fe6bd62664def5bcb6262f96 upstream. + +The Acer laptop Aspire E5-523G and ES1-432 with ALC255 can't detect +the headset microphone until ALC255_FIXUP_ACER_MIC_NO_PRESENCE quirk +applied. + +Signed-off-by: Chris Chiu +Signed-off-by: Daniel Drake +Signed-off-by: Jian-Hong Pan +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6710,6 +6710,8 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS), + SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK), ++ SND_PCI_QUIRK(0x1025, 0x1099, "Acer Aspire E5-523G", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x110e, "Acer Aspire ES1-432", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), diff --git a/queue-5.0/alsa-hda-realtek-add-support-headset-mode-for-dell-wyse-aio.patch b/queue-5.0/alsa-hda-realtek-add-support-headset-mode-for-dell-wyse-aio.patch new file mode 100644 index 00000000000..05620591c98 --- /dev/null +++ b/queue-5.0/alsa-hda-realtek-add-support-headset-mode-for-dell-wyse-aio.patch @@ -0,0 +1,68 @@ +From 136824efaab2c095fc911048f7c7ddeda258c965 Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Thu, 14 Mar 2019 16:22:45 +0800 +Subject: ALSA: hda/realtek - Add support headset mode for DELL WYSE AIO + +From: Kailang Yang + +commit 136824efaab2c095fc911048f7c7ddeda258c965 upstream. + +This patch will enable WYSE AIO for Headset mode. + +Signed-off-by: Kailang Yang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5682,6 +5682,9 @@ enum { + ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE, + ALC255_FIXUP_ACER_HEADSET_MIC, + ALC295_FIXUP_CHROME_BOOK, ++ ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE, ++ ALC225_FIXUP_WYSE_AUTO_MUTE, ++ ALC225_FIXUP_WYSE_DISABLE_MIC_VREF, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6658,6 +6661,28 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC + }, ++ [ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x16, 0x01011020 }, /* Rear Line out */ ++ { 0x19, 0x01a1913c }, /* use as Front headset mic, without its own jack detect */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC225_FIXUP_WYSE_AUTO_MUTE ++ }, ++ [ALC225_FIXUP_WYSE_AUTO_MUTE] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc_fixup_auto_mute_via_amp, ++ .chained = true, ++ .chain_id = ALC225_FIXUP_WYSE_DISABLE_MIC_VREF ++ }, ++ [ALC225_FIXUP_WYSE_DISABLE_MIC_VREF] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc_fixup_disable_mic_vref, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -6722,6 +6747,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB), ++ SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), diff --git a/queue-5.0/alsa-hda-realtek-add-support-headset-mode-for-new-dell-wyse-nb.patch b/queue-5.0/alsa-hda-realtek-add-support-headset-mode-for-new-dell-wyse-nb.patch new file mode 100644 index 00000000000..a7ed4f767d6 --- /dev/null +++ b/queue-5.0/alsa-hda-realtek-add-support-headset-mode-for-new-dell-wyse-nb.patch @@ -0,0 +1,29 @@ +From da484d00f020af3dd7cfcc6c4b69a7f856832883 Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Thu, 14 Mar 2019 15:50:59 +0800 +Subject: ALSA: hda/realtek - Add support headset mode for New DELL WYSE NB + +From: Kailang Yang + +commit da484d00f020af3dd7cfcc6c4b69a7f856832883 upstream. + +Enable headset mode support for new WYSE NB platform. + +Signed-off-by: Kailang Yang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6748,6 +6748,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), diff --git a/queue-5.0/alsa-hda-realtek-enable-asus-x441mb-and-x705fd-headset-mic-with-alc256.patch b/queue-5.0/alsa-hda-realtek-enable-asus-x441mb-and-x705fd-headset-mic-with-alc256.patch new file mode 100644 index 00000000000..6c4242f61c1 --- /dev/null +++ b/queue-5.0/alsa-hda-realtek-enable-asus-x441mb-and-x705fd-headset-mic-with-alc256.patch @@ -0,0 +1,60 @@ +From e1037354a0a75acdea2b27043c0a371ed85cf262 Mon Sep 17 00:00:00 2001 +From: Jian-Hong Pan +Date: Fri, 22 Mar 2019 11:37:18 +0800 +Subject: ALSA: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256 + +From: Jian-Hong Pan + +commit e1037354a0a75acdea2b27043c0a371ed85cf262 upstream. + +The ASUS laptop X441MB and X705FD with ALC256 cannot detect the headset +MIC until ALC256_FIXUP_ASUS_MIC_NO_PRESENCE quirk applied. + +Signed-off-by: Chris Chiu +Signed-off-by: Daniel Drake +Signed-off-by: Jian-Hong Pan +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5686,6 +5686,7 @@ enum { + ALC225_FIXUP_WYSE_AUTO_MUTE, + ALC225_FIXUP_WYSE_DISABLE_MIC_VREF, + ALC286_FIXUP_ACER_AIO_HEADSET_MIC, ++ ALC256_FIXUP_ASUS_MIC_NO_PRESENCE, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6694,6 +6695,15 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE + }, ++ [ALC256_FIXUP_ASUS_MIC_NO_PRESENCE] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x04a11120 }, /* use as headset mic, without its own jack detect */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -7332,6 +7342,10 @@ static const struct snd_hda_pin_quirk al + {0x14, 0x90170110}, + {0x1b, 0x90a70130}, + {0x21, 0x03211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE, ++ {0x1a, 0x90a70130}, ++ {0x1b, 0x90170110}, ++ {0x21, 0x03211020}), + SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, + {0x12, 0xb7a60130}, + {0x13, 0xb8a61140}, diff --git a/queue-5.0/alsa-hda-realtek-enable-headset-mic-of-acer-aio-with-alc286.patch b/queue-5.0/alsa-hda-realtek-enable-headset-mic-of-acer-aio-with-alc286.patch new file mode 100644 index 00000000000..a81ca369005 --- /dev/null +++ b/queue-5.0/alsa-hda-realtek-enable-headset-mic-of-acer-aio-with-alc286.patch @@ -0,0 +1,65 @@ +From 667a8f73753908c4d0171e52b71774f9be5d6713 Mon Sep 17 00:00:00 2001 +From: Jian-Hong Pan +Date: Fri, 15 Mar 2019 17:51:09 +0800 +Subject: ALSA: hda/realtek: Enable headset MIC of Acer AIO with ALC286 + +From: Jian-Hong Pan + +commit 667a8f73753908c4d0171e52b71774f9be5d6713 upstream. + +Some Acer AIO desktops like Veriton Z6860G, Z4860G and Z4660G cannot +record sound from headset MIC. This patch adds the +ALC286_FIXUP_ACER_AIO_HEADSET_MIC quirk to fix this issue. + +Fixes: 9f8aefed9623 ("ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4660G") +Fixes: b72f936f6b32 ("ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4860G/Z6860G") +Signed-off-by: Jian-Hong Pan +Reviewed-by: Kailang Yang +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5685,6 +5685,7 @@ enum { + ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE, + ALC225_FIXUP_WYSE_AUTO_MUTE, + ALC225_FIXUP_WYSE_DISABLE_MIC_VREF, ++ ALC286_FIXUP_ACER_AIO_HEADSET_MIC, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6683,6 +6684,16 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC + }, ++ [ALC286_FIXUP_ACER_AIO_HEADSET_MIC] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x4f }, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x5029 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -6699,9 +6710,9 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS), + SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK), +- SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), +- SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), +- SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), diff --git a/queue-5.0/alsa-hda-realtek-enable-headset-mic-of-acer-aspire-z24-890-with-alc286.patch b/queue-5.0/alsa-hda-realtek-enable-headset-mic-of-acer-aspire-z24-890-with-alc286.patch new file mode 100644 index 00000000000..e7327138fdf --- /dev/null +++ b/queue-5.0/alsa-hda-realtek-enable-headset-mic-of-acer-aspire-z24-890-with-alc286.patch @@ -0,0 +1,32 @@ +From 2733ccebf4a937a0858e7d05a4a003b89715033f Mon Sep 17 00:00:00 2001 +From: Jian-Hong Pan +Date: Thu, 21 Mar 2019 16:39:04 +0800 +Subject: ALSA: hda/realtek: Enable headset MIC of Acer Aspire Z24-890 with ALC286 + +From: Jian-Hong Pan + +commit 2733ccebf4a937a0858e7d05a4a003b89715033f upstream. + +The Acer Aspire Z24-890 cannot detect the headset MIC until +ALC286_FIXUP_ACER_AIO_HEADSET_MIC quirk applied. + +Signed-off-by: Jian-Hong Pan +Signed-off-by: Daniel Drake +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6713,6 +6713,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), diff --git a/queue-5.0/alsa-hda-realtek-enable-headset-mic-of-asus-p5440ff-with-alc256.patch b/queue-5.0/alsa-hda-realtek-enable-headset-mic-of-asus-p5440ff-with-alc256.patch new file mode 100644 index 00000000000..f8008f33caf --- /dev/null +++ b/queue-5.0/alsa-hda-realtek-enable-headset-mic-of-asus-p5440ff-with-alc256.patch @@ -0,0 +1,36 @@ +From a806ef1cf3bbc0baadc6cdeb11f12b5dd27e91c2 Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Fri, 22 Mar 2019 11:37:20 +0800 +Subject: ALSA: hda/realtek: Enable headset mic of ASUS P5440FF with ALC256 + +From: Chris Chiu + +commit a806ef1cf3bbc0baadc6cdeb11f12b5dd27e91c2 upstream. + +The ASUS laptop P5440FF with ALC256 can't detect the headset microphone +until ALC256_FIXUP_ASUS_MIC_NO_PRESENCE quirk applied. + +Signed-off-by: Chris Chiu +Signed-off-by: Daniel Drake +Signed-off-by: Jian-Hong Pan +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7343,6 +7343,10 @@ static const struct snd_hda_pin_quirk al + {0x1b, 0x90a70130}, + {0x21, 0x03211020}), + SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE, ++ {0x12, 0x90a60130}, ++ {0x14, 0x90170110}, ++ {0x21, 0x03211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE, + {0x1a, 0x90a70130}, + {0x1b, 0x90170110}, + {0x21, 0x03211020}), diff --git a/queue-5.0/alsa-hda-realtek-enable-headset-mic-of-asus-x430un-and-x512dk-with-alc256.patch b/queue-5.0/alsa-hda-realtek-enable-headset-mic-of-asus-x430un-and-x512dk-with-alc256.patch new file mode 100644 index 00000000000..c893bf8374e --- /dev/null +++ b/queue-5.0/alsa-hda-realtek-enable-headset-mic-of-asus-x430un-and-x512dk-with-alc256.patch @@ -0,0 +1,35 @@ +From 6ac371aa1a74240fb910c98aa3484d5ece8473d3 Mon Sep 17 00:00:00 2001 +From: Jian-Hong Pan +Date: Fri, 22 Mar 2019 11:37:22 +0800 +Subject: ALSA: hda/realtek: Enable headset MIC of ASUS X430UN and X512DK with ALC256 + +From: Jian-Hong Pan + +commit 6ac371aa1a74240fb910c98aa3484d5ece8473d3 upstream. + +The ASUS X430UN and X512DK with ALC256 cannot detect the headset MIC +until ALC256_FIXUP_ASUS_MIC_NO_PRESENCE quirk applied. + +Signed-off-by: Jian-Hong Pan +Signed-off-by: Daniel Drake +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7347,6 +7347,10 @@ static const struct snd_hda_pin_quirk al + {0x14, 0x90170110}, + {0x21, 0x03211020}), + SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE, ++ {0x12, 0x90a60130}, ++ {0x14, 0x90170110}, ++ {0x21, 0x04211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE, + {0x1a, 0x90a70130}, + {0x1b, 0x90170110}, + {0x21, 0x03211020}), diff --git a/queue-5.0/alsa-hda-realtek-fix-speakers-on-acer-predator-helios-500-ryzen-laptops.patch b/queue-5.0/alsa-hda-realtek-fix-speakers-on-acer-predator-helios-500-ryzen-laptops.patch new file mode 100644 index 00000000000..68426302b22 --- /dev/null +++ b/queue-5.0/alsa-hda-realtek-fix-speakers-on-acer-predator-helios-500-ryzen-laptops.patch @@ -0,0 +1,68 @@ +From e2a829b3da01b9b32c4d0291d042b8a6e2a98ca3 Mon Sep 17 00:00:00 2001 +From: Bernhard Rosenkraenzer +Date: Tue, 5 Mar 2019 00:38:19 +0100 +Subject: ALSA: hda/realtek - Fix speakers on Acer Predator Helios 500 Ryzen laptops + +From: Bernhard Rosenkraenzer + +commit e2a829b3da01b9b32c4d0291d042b8a6e2a98ca3 upstream. + +On an Acer Predator Helios 500 (Ryzen version), the laptop's speakers +don't work out of the box. + +The problem can be worked around with hdajackretask, remapping the +"Black Headphone, Right side" pin (0x21) to the Internal speaker. + +This patch adds a quirk to change this mapping by default. + +[ corrected ALC299_FIXUP_PREDATOR_SPK definition and adapted for the + latest tree by tiwai ] + +Signed-off-by: Bernhard Rosenkraenzer +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5687,6 +5687,7 @@ enum { + ALC225_FIXUP_WYSE_DISABLE_MIC_VREF, + ALC286_FIXUP_ACER_AIO_HEADSET_MIC, + ALC256_FIXUP_ASUS_MIC_NO_PRESENCE, ++ ALC299_FIXUP_PREDATOR_SPK, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6704,6 +6705,13 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE + }, ++ [ALC299_FIXUP_PREDATOR_SPK] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x21, 0x90170150 }, /* use as headset mic, without its own jack detect */ ++ { } ++ } ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -6722,6 +6730,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x1025, 0x1099, "Acer Aspire E5-523G", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x110e, "Acer Aspire ES1-432", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x1246, "Acer Predator Helios 500", ALC299_FIXUP_PREDATOR_SPK), + SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), +@@ -7122,6 +7131,7 @@ static const struct hda_model_fixup alc2 + {.id = ALC255_FIXUP_DELL_HEADSET_MIC, .name = "alc255-dell-headset"}, + {.id = ALC295_FIXUP_HP_X360, .name = "alc295-hp-x360"}, + {.id = ALC295_FIXUP_CHROME_BOOK, .name = "alc-sense-combo"}, ++ {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"}, + {} + }; + #define ALC225_STANDARD_PINS \ diff --git a/queue-5.0/alsa-hda-realtek-fixed-headset-mic-jd-not-stable.patch b/queue-5.0/alsa-hda-realtek-fixed-headset-mic-jd-not-stable.patch new file mode 100644 index 00000000000..ecba82bc941 --- /dev/null +++ b/queue-5.0/alsa-hda-realtek-fixed-headset-mic-jd-not-stable.patch @@ -0,0 +1,80 @@ +From 10f5b1b85ed10a80d45bc2db450e65bd792efaad Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Thu, 21 Feb 2019 16:10:22 +0800 +Subject: ALSA: hda/realtek - Fixed Headset Mic JD not stable + +From: Kailang Yang + +commit 10f5b1b85ed10a80d45bc2db450e65bd792efaad upstream. + +It will be lose Mic JD state when Chrome OS boot and headset was plugged. +Implement of reset combo jack JD. It will show normally. + +Fixes: e854747d7593 ("ALSA: hda/realtek - Enable headset button support for new codec") +Signed-off-by: Kailang Yang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 29 ++++++++++++++++++++++++++++- + 1 file changed, 28 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5519,6 +5519,26 @@ static void alc_fixup_headset_jack(struc + } + } + ++static void alc295_fixup_chromebook(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ ++ switch (action) { ++ case HDA_FIXUP_ACT_PRE_PROBE: ++ switch (codec->core.vendor_id) { ++ case 0x10ec0295: ++ alc_update_coef_idx(codec, 0x4a, 0x8000, 1 << 15); /* Reset HP JD */ ++ alc_update_coef_idx(codec, 0x4a, 0x8000, 0 << 15); ++ break; ++ case 0x10ec0236: ++ alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */ ++ alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15); ++ break; ++ } ++ break; ++ } ++} ++ + static void alc_fixup_disable_mic_vref(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -5672,6 +5692,7 @@ enum { + ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE, + ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE, + ALC255_FIXUP_ACER_HEADSET_MIC, ++ ALC295_FIXUP_CHROME_BOOK, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6648,6 +6669,12 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC + }, ++ [ALC295_FIXUP_CHROME_BOOK] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc295_fixup_chromebook, ++ .chained = true, ++ .chain_id = ALC225_FIXUP_HEADSET_JACK ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -7060,7 +7087,7 @@ static const struct hda_model_fixup alc2 + {.id = ALC255_FIXUP_DUMMY_LINEOUT_VERB, .name = "alc255-dummy-lineout"}, + {.id = ALC255_FIXUP_DELL_HEADSET_MIC, .name = "alc255-dell-headset"}, + {.id = ALC295_FIXUP_HP_X360, .name = "alc295-hp-x360"}, +- {.id = ALC225_FIXUP_HEADSET_JACK, .name = "alc-sense-combo"}, ++ {.id = ALC295_FIXUP_CHROME_BOOK, .name = "alc-sense-combo"}, + {} + }; + #define ALC225_STANDARD_PINS \ diff --git a/queue-5.0/alsa-hda-realtek-merge-alc_fixup_headset_jack-to-alc295_fixup_chromebook.patch b/queue-5.0/alsa-hda-realtek-merge-alc_fixup_headset_jack-to-alc295_fixup_chromebook.patch new file mode 100644 index 00000000000..d8ae7730592 --- /dev/null +++ b/queue-5.0/alsa-hda-realtek-merge-alc_fixup_headset_jack-to-alc295_fixup_chromebook.patch @@ -0,0 +1,111 @@ +From c8a9afa632f0fd45731d3353525faf1fdb362c89 Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Thu, 14 Mar 2019 09:21:08 +0100 +Subject: ALSA: hda/realtek: merge alc_fixup_headset_jack to alc295_fixup_chromebook + +From: Jaroslav Kysela + +commit c8a9afa632f0fd45731d3353525faf1fdb362c89 upstream. + +The ALC225_FIXUP_HEADSET_JACK fixup can be merged to alc295_fixup_chromebook. +There are no other users for ALC225_FIXUP_HEADSET_JACK other than +the chromebook hardware. + +Fixes: 10f5b1b85ed1 ("ALSA: hda/realtek - Fixed Headset Mic JD not stable") +Cc: Kailang Yang +Signed-off-by: Jaroslav Kysela +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 43 ++++++++++++------------------------------ + 1 file changed, 13 insertions(+), 30 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5489,7 +5489,7 @@ static void alc_headset_btn_callback(str + jack->jack->button_state = report; + } + +-static void alc_fixup_headset_jack(struct hda_codec *codec, ++static void alc295_fixup_chromebook(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { + +@@ -5499,6 +5499,16 @@ static void alc_fixup_headset_jack(struc + alc_headset_btn_callback); + snd_hda_jack_add_kctl(codec, 0x55, "Headset Jack", false, + SND_JACK_HEADSET, alc_headset_btn_keymap); ++ switch (codec->core.vendor_id) { ++ case 0x10ec0295: ++ alc_update_coef_idx(codec, 0x4a, 0x8000, 1 << 15); /* Reset HP JD */ ++ alc_update_coef_idx(codec, 0x4a, 0x8000, 0 << 15); ++ break; ++ case 0x10ec0236: ++ alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */ ++ alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15); ++ break; ++ } + break; + case HDA_FIXUP_ACT_INIT: + switch (codec->core.vendor_id) { +@@ -5519,26 +5529,6 @@ static void alc_fixup_headset_jack(struc + } + } + +-static void alc295_fixup_chromebook(struct hda_codec *codec, +- const struct hda_fixup *fix, int action) +-{ +- +- switch (action) { +- case HDA_FIXUP_ACT_PRE_PROBE: +- switch (codec->core.vendor_id) { +- case 0x10ec0295: +- alc_update_coef_idx(codec, 0x4a, 0x8000, 1 << 15); /* Reset HP JD */ +- alc_update_coef_idx(codec, 0x4a, 0x8000, 0 << 15); +- break; +- case 0x10ec0236: +- alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */ +- alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15); +- break; +- } +- break; +- } +-} +- + static void alc_fixup_disable_mic_vref(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -5688,7 +5678,6 @@ enum { + ALC294_FIXUP_ASUS_MIC, + ALC294_FIXUP_ASUS_HEADSET_MIC, + ALC294_FIXUP_ASUS_SPK, +- ALC225_FIXUP_HEADSET_JACK, + ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE, + ALC285_FIXUP_LENOVO_PC_BEEP_IN_NOISE, + ALC255_FIXUP_ACER_HEADSET_MIC, +@@ -6635,9 +6624,9 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC + }, +- [ALC225_FIXUP_HEADSET_JACK] = { ++ [ALC295_FIXUP_CHROME_BOOK] = { + .type = HDA_FIXUP_FUNC, +- .v.func = alc_fixup_headset_jack, ++ .v.func = alc295_fixup_chromebook, + }, + [ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE] = { + .type = HDA_FIXUP_PINS, +@@ -6669,12 +6658,6 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC255_FIXUP_HEADSET_MODE_NO_HP_MIC + }, +- [ALC295_FIXUP_CHROME_BOOK] = { +- .type = HDA_FIXUP_FUNC, +- .v.func = alc295_fixup_chromebook, +- .chained = true, +- .chain_id = ALC225_FIXUP_HEADSET_JACK +- }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { diff --git a/queue-5.0/alsa-pcm-don-t-suspend-stream-in-unrecoverable-pcm-state.patch b/queue-5.0/alsa-pcm-don-t-suspend-stream-in-unrecoverable-pcm-state.patch new file mode 100644 index 00000000000..c1e2424414c --- /dev/null +++ b/queue-5.0/alsa-pcm-don-t-suspend-stream-in-unrecoverable-pcm-state.patch @@ -0,0 +1,70 @@ +From 113ce08109f8e3b091399e7cc32486df1cff48e7 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 25 Mar 2019 10:38:58 +0100 +Subject: ALSA: pcm: Don't suspend stream in unrecoverable PCM state + +From: Takashi Iwai + +commit 113ce08109f8e3b091399e7cc32486df1cff48e7 upstream. + +Currently PCM core sets each opened stream forcibly to SUSPENDED state +via snd_pcm_suspend_all() call, and the user-space is responsible for +re-triggering the resume manually either via snd_pcm_resume() or +prepare call. The scheme works fine usually, but there are corner +cases where the stream can't be resumed by that call: the streams +still in OPEN state before finishing hw_params. When they are +suspended, user-space cannot perform resume or prepare because they +haven't been set up yet. The only possible recovery is to re-open the +device, which isn't nice at all. Similarly, when a stream is in +DISCONNECTED state, it makes no sense to change it to SUSPENDED +state. Ditto for in SETUP state; which you can re-prepare directly. + +So, this patch addresses these issues by filtering the PCM streams to +be suspended by checking the PCM state. When a stream is in either +OPEN, SETUP or DISCONNECTED as well as already SUSPENDED, the suspend +action is skipped. + +To be noted, this problem was originally reported for the PCM runtime +PM on HD-audio. And, the runtime PM problem itself was already +addressed (although not intended) by the code refactoring commits +3d21ef0b49f8 ("ALSA: pcm: Suspend streams globally via device type PM +ops") and 17bc4815de58 ("ALSA: pci: Remove superfluous +snd_pcm_suspend*() calls"). These commits eliminated the +snd_pcm_suspend*() calls from the runtime PM suspend callback code +path, hence the racy OPEN state won't appear while runtime PM. +(FWIW, the race window is between snd_pcm_open_substream() and the +first power up in azx_pcm_open().) + +Although the runtime PM issue was already "fixed", the same problem is +still present for the system PM, hence this patch is still needed. +And for stable trees, this patch alone should suffice for fixing the +runtime PM problem, too. + +Reported-and-tested-by: Jon Hunter +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/pcm_native.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -1426,8 +1426,15 @@ static int snd_pcm_pause(struct snd_pcm_ + static int snd_pcm_pre_suspend(struct snd_pcm_substream *substream, int state) + { + struct snd_pcm_runtime *runtime = substream->runtime; +- if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) ++ switch (runtime->status->state) { ++ case SNDRV_PCM_STATE_SUSPENDED: + return -EBUSY; ++ /* unresumable PCM state; return -EBUSY for skipping suspend */ ++ case SNDRV_PCM_STATE_OPEN: ++ case SNDRV_PCM_STATE_SETUP: ++ case SNDRV_PCM_STATE_DISCONNECTED: ++ return -EBUSY; ++ } + runtime->trigger_master = substream; + return 0; + } diff --git a/queue-5.0/alsa-pcm-fix-possible-oob-access-in-pcm-oss-plugins.patch b/queue-5.0/alsa-pcm-fix-possible-oob-access-in-pcm-oss-plugins.patch new file mode 100644 index 00000000000..2296895dbdb --- /dev/null +++ b/queue-5.0/alsa-pcm-fix-possible-oob-access-in-pcm-oss-plugins.patch @@ -0,0 +1,104 @@ +From ca0214ee2802dd47239a4e39fb21c5b00ef61b22 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 22 Mar 2019 16:00:54 +0100 +Subject: ALSA: pcm: Fix possible OOB access in PCM oss plugins + +From: Takashi Iwai + +commit ca0214ee2802dd47239a4e39fb21c5b00ef61b22 upstream. + +The PCM OSS emulation converts and transfers the data on the fly via +"plugins". The data is converted over the dynamically allocated +buffer for each plugin, and recently syzkaller caught OOB in this +flow. + +Although the bisection by syzbot pointed out to the commit +65766ee0bf7f ("ALSA: oss: Use kvzalloc() for local buffer +allocations"), this is merely a commit to replace vmalloc() with +kvmalloc(), hence it can't be the cause. The further debug action +revealed that this happens in the case where a slave PCM doesn't +support only the stereo channels while the OSS stream is set up for a +mono channel. Below is a brief explanation: + +At each OSS parameter change, the driver sets up the PCM hw_params +again in snd_pcm_oss_change_params_lock(). This is also the place +where plugins are created and local buffers are allocated. The +problem is that the plugins are created before the final hw_params is +determined. Namely, two snd_pcm_hw_param_near() calls for setting the +period size and periods may influence on the final result of channels, +rates, etc, too, while the current code has already created plugins +beforehand with the premature values. So, the plugin believes that +channels=1, while the actual I/O is with channels=2, which makes the +driver reading/writing over the allocated buffer size. + +The fix is simply to move the plugin allocation code after the final +hw_params call. + +Reported-by: syzbot+d4503ae45b65c5bc1194@syzkaller.appspotmail.com +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/oss/pcm_oss.c | 43 ++++++++++++++++++++++--------------------- + 1 file changed, 22 insertions(+), 21 deletions(-) + +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -940,6 +940,28 @@ static int snd_pcm_oss_change_params_loc + oss_frame_size = snd_pcm_format_physical_width(params_format(params)) * + params_channels(params) / 8; + ++ err = snd_pcm_oss_period_size(substream, params, sparams); ++ if (err < 0) ++ goto failure; ++ ++ n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size); ++ err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL); ++ if (err < 0) ++ goto failure; ++ ++ err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS, ++ runtime->oss.periods, NULL); ++ if (err < 0) ++ goto failure; ++ ++ snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL); ++ ++ err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams); ++ if (err < 0) { ++ pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err); ++ goto failure; ++ } ++ + #ifdef CONFIG_SND_PCM_OSS_PLUGINS + snd_pcm_oss_plugin_clear(substream); + if (!direct) { +@@ -974,27 +996,6 @@ static int snd_pcm_oss_change_params_loc + } + #endif + +- err = snd_pcm_oss_period_size(substream, params, sparams); +- if (err < 0) +- goto failure; +- +- n = snd_pcm_plug_slave_size(substream, runtime->oss.period_bytes / oss_frame_size); +- err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, n, NULL); +- if (err < 0) +- goto failure; +- +- err = snd_pcm_hw_param_near(substream, sparams, SNDRV_PCM_HW_PARAM_PERIODS, +- runtime->oss.periods, NULL); +- if (err < 0) +- goto failure; +- +- snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL); +- +- if ((err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_HW_PARAMS, sparams)) < 0) { +- pcm_dbg(substream->pcm, "HW_PARAMS failed: %i\n", err); +- goto failure; +- } +- + if (runtime->oss.trigger) { + sw_params->start_threshold = 1; + } else { diff --git a/queue-5.0/alsa-rawmidi-fix-potential-spectre-v1-vulnerability.patch b/queue-5.0/alsa-rawmidi-fix-potential-spectre-v1-vulnerability.patch new file mode 100644 index 00000000000..5995995dba6 --- /dev/null +++ b/queue-5.0/alsa-rawmidi-fix-potential-spectre-v1-vulnerability.patch @@ -0,0 +1,52 @@ +From 2b1d9c8f87235f593826b9cf46ec10247741fff9 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Wed, 20 Mar 2019 16:15:24 -0500 +Subject: ALSA: rawmidi: Fix potential Spectre v1 vulnerability + +From: Gustavo A. R. Silva + +commit 2b1d9c8f87235f593826b9cf46ec10247741fff9 upstream. + +info->stream is indirectly controlled by user-space, hence leading to +a potential exploitation of the Spectre variant 1 vulnerability. + +This issue was detected with the help of Smatch: + +sound/core/rawmidi.c:604 __snd_rawmidi_info_select() warn: potential spectre issue 'rmidi->streams' [r] (local cap) + +Fix this by sanitizing info->stream before using it to index +rmidi->streams. + +Notice that given that speculation windows are large, the policy is +to kill the speculation on the first load and not worry if it can be +completed with a dependent load/store [1]. + +[1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ + +Cc: stable@vger.kernel.org +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/rawmidi.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -601,6 +602,7 @@ static int __snd_rawmidi_info_select(str + return -ENXIO; + if (info->stream < 0 || info->stream > 1) + return -EINVAL; ++ info->stream = array_index_nospec(info->stream, 2); + pstr = &rmidi->streams[info->stream]; + if (pstr->substream_count == 0) + return -ENOENT; diff --git a/queue-5.0/alsa-seq-oss-fix-spectre-v1-vulnerability.patch b/queue-5.0/alsa-seq-oss-fix-spectre-v1-vulnerability.patch new file mode 100644 index 00000000000..90fa940aa5d --- /dev/null +++ b/queue-5.0/alsa-seq-oss-fix-spectre-v1-vulnerability.patch @@ -0,0 +1,53 @@ +From c709f14f0616482b67f9fbcb965e1493a03ff30b Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Wed, 20 Mar 2019 18:42:01 -0500 +Subject: ALSA: seq: oss: Fix Spectre v1 vulnerability + +From: Gustavo A. R. Silva + +commit c709f14f0616482b67f9fbcb965e1493a03ff30b upstream. + +dev is indirectly controlled by user-space, hence leading to +a potential exploitation of the Spectre variant 1 vulnerability. + +This issue was detected with the help of Smatch: + +sound/core/seq/oss/seq_oss_synth.c:626 snd_seq_oss_synth_make_info() warn: potential spectre issue 'dp->synths' [w] (local cap) + +Fix this by sanitizing dev before using it to index dp->synths. + +Notice that given that speculation windows are large, the policy is +to kill the speculation on the first load and not worry if it can be +completed with a dependent load/store [1]. + +[1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ + +Cc: stable@vger.kernel.org +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/seq/oss/seq_oss_synth.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/sound/core/seq/oss/seq_oss_synth.c ++++ b/sound/core/seq/oss/seq_oss_synth.c +@@ -617,13 +617,14 @@ int + snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_info *inf) + { + struct seq_oss_synth *rec; ++ struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev); + +- if (dev < 0 || dev >= dp->max_synthdev) ++ if (!info) + return -ENXIO; + +- if (dp->synths[dev].is_midi) { ++ if (info->is_midi) { + struct midi_info minf; +- snd_seq_oss_midi_make_info(dp, dp->synths[dev].midi_mapped, &minf); ++ snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf); + inf->synth_type = SYNTH_TYPE_MIDI; + inf->synth_subtype = 0; + inf->nr_voices = 16; diff --git a/queue-5.0/series b/queue-5.0/series index 7bc84152def..c7b703f079c 100644 --- a/queue-5.0/series +++ b/queue-5.0/series @@ -51,3 +51,18 @@ nfs-fix-nfs4_lock_state-refcounting-in-nfs4_alloc_-lock-unlock-data.patch nfs-fix-mount-umount-race-in-nlmclnt.patch nfsv4.1-don-t-free-interrupted-slot-on-open.patch net-dsa-qca8k-remove-leftover-phy-accessors.patch +alsa-rawmidi-fix-potential-spectre-v1-vulnerability.patch +alsa-seq-oss-fix-spectre-v1-vulnerability.patch +alsa-pcm-fix-possible-oob-access-in-pcm-oss-plugins.patch +alsa-pcm-don-t-suspend-stream-in-unrecoverable-pcm-state.patch +alsa-hda-realtek-fixed-headset-mic-jd-not-stable.patch +alsa-hda-realtek-merge-alc_fixup_headset_jack-to-alc295_fixup_chromebook.patch +alsa-hda-realtek-add-support-headset-mode-for-dell-wyse-aio.patch +alsa-hda-realtek-add-support-headset-mode-for-new-dell-wyse-nb.patch +alsa-hda-realtek-enable-headset-mic-of-acer-aio-with-alc286.patch +alsa-hda-realtek-enable-headset-mic-of-acer-aspire-z24-890-with-alc286.patch +alsa-hda-realtek-add-support-for-acer-aspire-e5-523g-es1-432-headset-mic.patch +alsa-hda-realtek-enable-asus-x441mb-and-x705fd-headset-mic-with-alc256.patch +alsa-hda-realtek-enable-headset-mic-of-asus-p5440ff-with-alc256.patch +alsa-hda-realtek-enable-headset-mic-of-asus-x430un-and-x512dk-with-alc256.patch +alsa-hda-realtek-fix-speakers-on-acer-predator-helios-500-ryzen-laptops.patch -- 2.47.2